Not long ago, most phishing emails were easy to recognise. They had odd grammar, a greeting like “Dear Costumer,” and an urgent request to “kindly verify” your bank details. That has changed a lot. Now a similar email can come in flawless English or Arabic. It may use your actual manager’s name and refer to a project from last week. Attackers have started using artificial intelligence, the same as everybody else.

Old crimes, faster tools

Phishing, malware and password attacks were around long before chatbots, so AI didn’t create them. It made them quicker and bigger. A criminal who once managed around ten believable emails a day can now send thousands, and every one can be adjusted for a single person. A job that once needed a trained team is now possible for one person with a laptop and some well-written prompts.

Phishing emails that read well

Language models write text that sounds natural, and attackers take advantage of that. They gather public details from LinkedIn, company websites or social media and ask a model to copy the company’s normal way of writing. What comes out doesn’t look like spam at all. It reads like an ordinary message from HR.

In 2023, tools called WormGPT and FraudGPT were sold on criminal forums as “AI without limits.” I suspect some of them were mostly hype. The basic idea behind them works, though, and it will probably stay with us.

Malware that keeps changing

Older antivirus programs mainly used signatures, which means they looked for known pieces of malicious code. With AI, an attacker can rewrite the same code many times so each copy looks a bit different. Beginners can also get help writing scripts they couldn’t manage alone.

AI-generated malware is often full of bugs, and a beginner doesn’t become an expert overnight. What worries security people more is that getting started is now much easier. More people try, and some of them get lucky.

Quicker research before an attack

Attackers first need to know which systems a company runs, who works there and which servers can be reached from the internet. Collecting this used to take days or even weeks. AI lets them summarise leaked data, go through scan results and spot weaknesses in far less time. The attack may look familiar, but the planning behind it happens faster.

AI on the defending side

Security teams use AI too, and in many cases they get more out of it. Modern EDR tools and SIEM platforms rely on machine learning to notice strange behaviour. One example is a user who logs in from two countries within one hour. Another is a laptop that starts uploading huge amounts of data at 3 a.m. Analysts in a Security Operations Centre can receive thousands of alerts a day, and AI helps them sort out which ones need attention first. Attackers and defenders are both speeding up at the same time.

Practical steps

Basic defences still work, and they matter more than before.

• Check through another channel. When an email asks for money or a password, phone the person on a number you already have, not the one written in the message.
• Turn on multi-factor authentication. Security keys and other phishing-resistant methods are the safest choice.
• Use realistic examples in training. Teaching staff to look for spelling mistakes isn’t enough anymore.
• Be careful with friendly, professional messages too. A polite tone proves nothing.

AI hasn’t made attackers smarter, but it has made them faster and more believable. Defenders can no longer count on bad grammar or obvious errors to give an attack away. We need to check the process behind a request, whatever the email looks like. If a message feels a little strange, even a well-written one, take a moment and look again.

Contributed by GuestPosts.biz